Version 7.260817.0

Enhancements:

• #7258 feat(connectors-sdk): add CourseOfAction and CaseIncident models
• #7256 feat(connectors-sdk): add labels field to Infrastructure model
• #6820 feat(threat-landscape): add external import connector
• #6595 feat(dark-web-informer): create the external import connector
• #6070 feat(connectors-sdk): add aliases and labels fields to OCTI models when missing

Bug Fixes:

• #7270 fix(greynoise-feed): uncaught ValueError when parsing last_seen with unexpected date format
• #7267 fix(zscaler): remove unused OpenCTIApiClient initialization causing startup crash
• #7264 fix(servicenow): connector crashes instantly when deployed via composer due to unhandled int(None) in get_config_variable
• #7261 fix(misp): TypeError 'ObjectItemObjectReference' object is not subscriptable in process_events
• #6948 fix(thehive): crashes on startup with import_from_date, on empty runs, and on TheHive 4 comment/attachment fetches
• #6677 fix(import-document): IPv4 addresses extracted as Phone-Number observables by import-document connector

Community Contributions Highlight:

• feat(threat-landscape): implement Threat Landscape connector (#6820) by Threat Landscape (@threatlandscape) in #6450
• fix(import-document): prevent IP addresses being classified as phone numbers (#6677) by Zen Dodd (@steadytao) in #7065

---

Pull Requests:

• fix(thehive): repair startup, idle-run and thehive 4 crashes after refactor (#6948) by FilipeS0usa (@FilipeS0usa) in #6949
• fix(misp): fix not subscriptable object in process_events (#7261) by Pauline Eustachy (@Powlinett) in #7275
• docs(recorded-future): clarify analyst notes only import primary entities (#7279) by Romain GUIGNARD (@romain-filigran) in #7280
• ci: retry connector image builds with backoff on transient registry errors (#7162) by Nicolas Carenton (@ncarenton) in #7163
• fix(zscaler): remove unused OpenCTIApiClient initialization causing startup crash (#7267) by Romain GUIGNARD (@romain-filigran) in #7274
• fix(greynoise-feed): uncaught ValueError when parsing last_seen with unexpected date format (#7270) by Pauline Eustachy (@Powlinett) in #7281
• fix(greynoise-feed): remove unused last_seen parsing that could still raise ValueError (#7270) by Pauline Eustachy (@Powlinett) in #7283
• fix(servicenow): resolve crash on composer deployment from unhandled int(None) (#7264) by Pauline Eustachy (@Powlinett) in #7276
• docs(sublime): update connector_manifest.json (#7211) by Jermain @ Filigran.io (@Jermain-N) in #7287
• feat(connectors-sdk): add CourseOfAction and CaseIncident models (#7258) by Pauline Eustachy (@Powlinett) in #7259
• feat(flare): add more filtering options (#7284) by Xavier Lavallee (@xvaier) in #7285
• fix(import-document): prevent IP addresses being classified as phone numbers (#6677) by Zen Dodd (@steadytao) in #7065
• feat(threat-landscape): implement Threat Landscape connector (#6820) by Threat Landscape (@threatlandscape) in #6450
• feat(dark-web-informer): add passthrough external-import connector (#6595) by Gamezilla19 (@gamezilla19) in #6596
• fix(portspoof): Upgrade pika deps to be compatible with pycti (#7284) by Hugo Dupras (@jabesq) in #7302

New Contributors:

• Zen Dodd (@steadytao) made their first contribution in #7065
• Threat Landscape (@threatlandscape) made their first contribution in #6450

Full Changelog: 7.260811.0...7.260817.0

Version 7.260309.0-lts.7

---

Full Changelog: 7.260309.0-lts.6...7.260309.0-lts.7

Version 7.260811.0

Enhancements:

• #7149 feat(connector-domaintools-iris-detect): new connector
• #6911 feat(ransomwarelive): support ransomware.live API-PRO (configurable base URL + API key)
• #6829 feat(modat-enrichment): create the connector
• #6703 feat(connectors): add Lab539 AiTM Feed external import connector

Bug Fixes:

• #7207 fix(modat-enrichment): fix connector metadata
• #7205 fix(lab539-aitm-feed): fix connector metadata
• #7198 fix(infoblox): connector crash
• #7181 fix(import-ttps-file-navigator): contextual import fails with error 'AppLogger' object is not callable

Pull Requests:

• docs(intel471): Clarify Verity471-specific prerequisites (#7204) by Jermain @ Filigran.io (@Jermain-N) in #7192
• feat(lab539-aitm-feed): add external import connector (#6703) by John Fitzpatrick (@Lab539) in #6704
• feat(modat-enrichment): add Modat internal enrichment connector (#6829) by RT-MDT in #6830
• fix(infoblox): add missing WORKDIR so the entrypoint finds main.py (#7198) by Romain GUIGNARD (@romain-filigran) in #7203
• fix(import-ttps-file-navigator): connector_logger is not callable in contextual import (#7181) by Romain GUIGNARD (@romain-filigran) in #7202
• fix(modat-enrichment): update connector metadata, logo and update pycti version (#7207) by Romain GUIGNARD (@romain-filigran) in #7208
• fix(lab539-aitm-feed): update connector metadata (#7205) by Romain GUIGNARD (@romain-filigran) in #7206
• fix(manifest): fix connector manifests and logo (#7211) by Romain GUIGNARD (@romain-filigran) in #7201
• feat(ransomwarelive): support ransomware.live api-pro client (#6911) by Pauline Eustachy (@Powlinett) in #7166
• test: verify every connector entrypoint points to an existing file (#7170) by Nicolas Carenton (@ncarenton) in #7172
• fix(connectors-sdk): revert annotated_types.py changes from PR #7101 (#7213) by Pauline Eustachy (@Powlinett) in #7214
• feat: new DomainTools Iris Detect connector (#7149) by nnguyen-1 in #7147
• revert(connectors-sdk): restore annotated_types.py changes from PR #7101 (#7213) by Pauline Eustachy (@Powlinett) in #7231
• docs: update README and manifest with correct name (#7227) by nnguyen-1 in #7228

New Contributors:

• Jermain @ Filigran.io (@Jermain-N) made their first contribution in #7192
• John Fitzpatrick (@Lab539) made their first contribution in #6704
• RT-MDT made their first contribution in #6830

Full Changelog: 7.260807.0...7.260811.0

Version 7.260807.0

Enhancements:

• #7063 feat(stream-microsoft-sentinel-intel): Add native azure auth
• #7043 feat(cloudflare): add Cloudflare Rules List stream connector
• #7042 feat(metras): Add Metras EDR connector suite (external-import, internal-enrichment, stream)
• #7036 feat(email-cases-importer): add connector to import emails as incident-response cases

Bug Fixes:

• #7157 fix: ModuleNotFoundError: No module named 'magic' for connectors importing magic

---

Pull Requests:

• chore(deps): update dependency cryptography to v50 [security] by renovate[bot] in #7160
• feat(stream-microsoft-sentinel-intel): add native azure auth (#7063) by Renizmy in #7064
• feat(email-cases-importer): add connector to import emails as incident-response cases (#7036) by Khidr6G in #7037
• feat(metras): add Metras external-import connector for EDR telemetry (#7042) by Khidr6G in #7039
• feat(metras): add Metras internal-enrichment connector for fleet-presence lookups (#7042) by Khidr6G in #7040
• feat(metras): add Metras stream connector for blocklist sync (#7042) by Khidr6G in #7041
• test(all): update connector_config_schema.json tests (#6342) by Pauline Eustachy (@Powlinett) in #7146
• feat(cloudflare-rules-list): add Cloudflare Rules List stream connector (#7043) by Khidr6G in #7044

Full Changelog: 7.260803.0...7.260807.0

Version 7.260803.0

Enhancements:

• #7128 feat(domaintools-feeds): create external-import connector
• #7127 feat(domaintools-irisql): create external-import connector
• #7124 feat(vulners): send an identifying User-Agent to the Vulners API
• #7114 refactor(socradar): migrate connector to be connector manager supported
• #6940 feat(MalwareBazaar): Add external references to indicators linking to MalwareBazaar
• #6868 feat(ThreatMatch): migrate connector to the catalog
• #5256 refactor(sumologic-intel): migrate connector to be connector manager supported
• #2044 feat(malwarebazaar): improve the connector

Bug Fixes:

• #7154 fix(external-import/opencti): align UBI9 CONNECTOR_CMD with actual entrypoint
• #7152 fix(import-file-stix): PermissionError on /.stixmarx at startup for non-root/arbitrary-UID deployments
• #7144 fix(converter): invalid indicator value and add API metadata
• #7138 fix(google-ti-feeds): indicator/observable score defaults to 50 for benign IOCs with a real score of 0
• #7100 fix(connectors-sdk): BaseSettings serialization and security issues
• #7025 fix(Doppel): URLs are being ingested as Domain Names

---

Pull Requests:

• feat(domaintools): add DomainTools IrisQL and Feeds connector for OpenCTI (#7128) (#7127) by nnguyen-1 in #7121
• feat(vulners): send an identifying User-Agent to the Vulners API (#7124) by yokotoka-vulners-com in #7125
• feat(threatmatch): migrate connector to manager-supported mode (#6868) by Hugo Dupras (@jabesq) in #6996
• refactor(socradar): migrate connector to be connector manager supported (#7114) by Thibaut Rouxel (@throuxel) in #7129
• fix(connectors-sdk): BaseSettings serialization and security issues (#7100) by Pauline Eustachy (@Powlinett) in #7101
• fix(threatmatch): update unit tests after connectors_sdk update (#7100) by Pauline Eustachy (@Powlinett) in #7136
• test(all): add connector_config_schema.json validation tests (#6342) by Pauline Eustachy (@Powlinett) in #7085
• feat(malwarebazaar): add external references and link indicators to malware family (#6940, #2044) by Romain GUIGNARD (@romain-filigran) in #7023
• fix: indicator value is not valid and add API metadata (#7144) by nnguyen-1 in #7143
• feat(sumologic-intel): Add connector to catalog (#5256) by Thibaut Rouxel (@throuxel) in #7135
• fix(google-ti-feeds): fix indicator/observable score defaulting to 50 for benign IOCs (#7138) by Brett Fitzpatrick (@brett-fitz) in #7139
• fix(import-file-stix): pre-generate stixmarx cache to fix /.stixmarx PermissionError (#7152) by Nicolas Carenton (@ncarenton) in #7153
• fix(opencti): align UBI9 CONNECTOR_CMD with actual entrypoint (#7154) by Pauline Eustachy (@Powlinett) in #7155
• fix: declare python-magic dependency for connectors importing magic (#7157) by Nicolas Carenton (@ncarenton) in #7156
• fix(doppel): map alerts to valid STIX observables (#7025) by Evan Ishibashi (@evan-ishibashi) in #7148
• chore(release): revert release commit 7.260803.0 (#7159) by Nicolas Carenton (@ncarenton) in #7158

New Contributors:

• nnguyen-1 made their first contribution in #7121
• Evan Ishibashi (@evan-ishibashi) made their first contribution in #7148

Full Changelog: 7.260728.0...7.260803.0

Version 7.260728.0

Enhancements:

• #7105 feat(spur): create external-import connector
• #7075 feat(decoupling): manifest fragments improvements and misc fixes
• #7057 feat(crowdstrike-recon): add UBI9 image build support
• #7053 feat(google-ti-feeds): parametrize sub-entities to fetch per data collection
• #7033 feat(doppel-alert-takedown): add Doppel Alert and Takedown internal enrichment connector
• #7024 feat(google-ti-feeds): add malware/threat actor association filters for Delta Sync indicator import
• #6989 feat(ransomlook): create the connector
• #6946 feat(manifest): add "License Type" metadata to characterize connector's associated feed/solution license
• #6865 feat(Zscaler): migrate connector to the catalog
• #6863 feat(ZeroFox): migrate connector to the catalog
• #6862 feat(ServiceNow): migrate connector to the catalog
• #6861 feat(SOC Prime): migrate connector to the catalog
• #6860 feat(Shodan InternetDB): migrate connector to the catalog
• #6855 feat(google-ti-feeds): Add minimum GTI score filter for Delta Sync indicator import
• #6853 feat(MalBeacon): migrate connector to the catalog
• #6771 feat(Import File STIX): migrate connector to the catalog

Bug Fixes:

• #7070 fix(taxii-post): empty token env var prevents basic auth fallback
• #6555 fix(urlscan): ignores some user configs
• #4756 fix(hatching-triage): unable to enrich URL

---

Pull Requests:

• feat(socprime): migrate connector to manager-supported mode (#6861) by Hugo Dupras (@jabesq) in #7049
• feat(zerofox): migrate connector to manager-supported mode (#6863) by Hugo Dupras (@jabesq) in #7052
• feat(shodan-internetdb): migrate connector to manager-supported mode (#6860) by Hugo Dupras (@jabesq) in #7048
• feat(zscaler): migrate connector to manager-supported mode (#6865) by Hugo Dupras (@jabesq) in #7050
• feat(google-ti-feeds): add GTI_INDICATOR_MIN_SCORE filter for Delta Sync indicators (#6855) by Hugo Dupras (@jabesq) in #7074
• feat(manifest-fragment): enforce enum-based fields and passthrough unmapped keys (#6928) by Hugo Dupras (@jabesq) in #7029
• feat(ransomlook): add RansomLook connector (#6989) by Bart Lauwers (@blauwers) in #7001
• feat(malbeacon): migrate connector to manager-supported mode (#6853) by Hugo Dupras (@jabesq) in #7051
• feat(doppel-alert-takedown): add Doppel Alert and Takedown internal enrichment connector (#7033) by Romain GUIGNARD (@romain-filigran) in #7034
• feat(servicenow): migrate connector to manager-supported mode (#6862) by Hugo Dupras (@jabesq) in #6997
• feat(google-ti-feeds): parametrize sub-entities to fetch per data collection (#7053) by Hugo Dupras (@jabesq) in #7073
• chore(connectors): bump pycti pins and misc connector fixes (#7053) by Hugo Dupras (@jabesq) in #7088
• chore(ci): add crowdstrike-recon to ubi9 image build support (#7057) by Hugo Dupras (@jabesq) in #7092
• feat(import-file-stix): migrate connector to manager_supported mode (#6771) by Helene Nguyen (@helene-nguyen) in #7087
• chore(deps): update dependency google-api-python-client to v2.198.0 by renovate[bot] in #7020
• fix(deps): update dependency aiohttp to v3.14.1 [security] by renovate[bot] in #7089
• chore(deps): update dependency requests to v2.33.0 [security] by renovate[bot] in #7006
• chore(ci): improve bulk release visibility and manifest workflow (#7075) by Hugo Dupras (@jabesq) in #7082
• fix(ci): support LTS version format MAJOR.YYMMDD.PATCH-lts.N in release tooling (#6019) by Hugo Dupras (@jabesq) in #7103
• feat(spur): implement Spur external-import connector (#2662) by Dan Urson (@plygrnd) in #6958
• fix(hatching-triage-sandbox): handle search API errors gracefully (#4756) by Thibaut Rouxel (@throuxel) in #7081
• chore(deps): update dependency google-api-core to v2.33.0 by renovate[bot] in #7107
• chore(deps): update actions/setup-python action to v6.3.0 by renovate[bot] in #7106
• feat(google-ti-feeds): add malware/threat actor filter (#7024) by Thibaut Rouxel (@throuxel) in #7090
• chore(anyrun): update connector titles, descriptions and naming (#7111) by ANY.RUN Integrations (@anyrun-integrations) in #7112
• fix(urlscan): honor config labels and duration_period (#6555) by Hugo Dupras (@jabesq) in #7091
• fix(deps): bump pytest to 9.0.3 to fix vulnerable tmpdir handling (#7109) by Thibaut Rouxel (@throuxel) in #7110
• fix(taxii-post): empty token env var prevents basic auth fallback (#7070) by Thibaut Rouxel (@throuxel) in #7071

New Contributors:

• ANY.RUN Integrations (@anyrun-integrations) made their first contribution in #7112

Full Changelog: 7.260722.0...7.260728.0

Version 7.260722.0

Enhancements:

• #6983 feat(ioc-extractor): upgrade connector to verified status
• #6936 feat(decoupling): chunk 6 bulk release tool
• #6928 feat(manifest): introduce "solution_categories" field to classify connectors by solution type
• #6867 feat(TweetFeed): migrate connector to the catalog
• #6864 feat(Zvelo): migrate connector to the catalog
• #6857 feat(Splunk): migrate connector to the catalog
• #6856 feat(TeamT5): migrate connector to the catalog
• #6854 feat(Atlassian Jira): migrate connector to the catalog
• #6852 feat(Maltiverse): migrate connector to the catalog
• #6851 feat(Malcore): migrate connector to the catalog
• #6849 feat(RST Report Hub): migrate connector to the catalog
• #6848 feat(RST Threat Feed): migrate connector to the catalog
• #6847 feat(Cofense ThreatHQ): migrate connector to the catalog
• #6846 feat(Citalid): migrate connector to the catalog
• #6844 feat(Greynoise): migrate connector to the catalog
• #6662 feat(zerofox-alerts): new integration for Zero Fox Alerts

Bug Fixes:

• #7045 fix(misp): error with attribute filter
• #7031 fix(opencti-stream): STIX bundle created with applicant_id: null
• #6912 fix(Intel 471v2): TypeError init unexpected keyword arg 'proxy'
• #6813 fix(sekoia): no timeouts for http requests

---

Pull Requests:

• feat(export-file-csv): allow filtering of export columns to specified visible columns (#11640) by scarletmerlin123 in #6267
• docs: allow manual do not merge label on pull requests (#7030) by Hugo Dupras (@jabesq) in #7027
• fix(sekoia): add timeouts for requests (#6813) by Axel Fahy (@axelfahy) in #6814
• feat(manifests): add new fields (solution_categories and license_type) in all connectors manifests (#6928) by Romain GUIGNARD (@romain-filigran) in #6991
• fix(manifests): restore verified and related manifest fields (#6928) by Hugo Dupras (@jabesq) in #7047
• fix(misp): add filter_passed_count to current bundle (#7045) by Thibaut Rouxel (@throuxel) in #7046
• feat(ci): add manifest fragment generation and connectors-sdk pinning to connector release (#6888) by Hugo Dupras (@jabesq) in #6913
• ci: add bulk connector release orchestration (#6936) by Hugo Dupras (@jabesq) in #6962
• chore(ci): Fix isort issue (#6936) by Hugo Dupras (@jabesq) in #7060
• revert(google-ti-feeds): enable IOC fetching for campaigns (#7053) by Hugo Dupras (@jabesq) in #7054
• feat(ioc-extractor): upgrade connector to verified status (#6983) by Nicolas Carenton (@ncarenton) in #6985
• feat(zvelo): add to catalog (#6864) by Thibaut Rouxel (@throuxel) in #7062
• feat(teamt5): add to catalog (#6856) by Thibaut Rouxel (@throuxel) in #7055
• docs(manifests): update manifests documentation, examples and templates (#6926) (#6927) (#6928) (#6946) by Pauline Eustachy (@Powlinett) in #6992
• feat(manifests): Add new fields in connectors manifests / contracts (#6926) (#6927) (#6928) (#6946) by Pauline Eustachy (@Powlinett) in #6990
• test(manifests): update unit tests of connectors manifest and global manifest (#6926) (#6927) (#6928) (#6946) by Pauline Eustachy (@Powlinett) in #6998
• chore(deps): bump pytest from 8.3.4 to 9.0.3 in /internal-enrichment/osint-industries/tests by Dependabot (@dependabot)[bot] in #7022
• fix(opencti-stream): add configurable default applicant for stream events without origin user (#7031) by Hugo Dupras (@jabesq) in #7035
• chore(deps): bump pytest from 8.4.2 to 9.0.3 in /internal-export-file/export-file-csv/tests by Dependabot (@dependabot)[bot] in #7072
• feat(splunk): migrate connector to manager-supported mode (#6857) by Hugo Dupras (@jabesq) in #6995
• feat(zerofox-alerts): create connector (#6662) by Thibaut Rouxel (@throuxel) in #6976
• feat(greynoise): update connector to be "manager_supported" (#6844) by Pauline Eustachy (@Powlinett) in #7015
• feat(rst-report-hub): update connector to be "manager_supported" (#6849) by Pauline Eustachy (@Powlinett) in #7028
• feat(citalid): update connector to be "manager_supported" (#6846) by Pauline Eustachy (@Powlinett) in #7014
• fix(intel471_v2): fix proxy for titan (#6912) by Thibaut Rouxel (@throuxel) in #7069
• feat(tweetfeed): migrate connector to manager-supported mode (#6867) by Hugo Dupras (@jabesq) in #6994
• feat(maltiverse): migrate connector to manager_supported mode (#6852) by Pauline Eustachy (@Powlinett) in #7059
• feat(malcore): migrate connector to manager_supported mode (#6851) by Pauline Eustachy (@Powlinett) in #7056
• feat(rst-threat-feed): update connector to be "manager_supported" (#6848) by Pauline Eustachy (@Powlinett) in #7026
• feat(cofense-threathq): update connector to be "manager_supported" (#6847) by Pauline Eustachy (@Powlinett) in #7019
• feat(jira): migrate connector to manager_supported mode (#6854) by Pauline Eustachy (@Powlinett) in #7061
• fix(rst-threat-feed): use deterministic ids for stix threat objects (#6848) by Hugo Dupras (@jabesq) in #7076

Full Changelog: 7.260715.0...7.260722.0

Version 7.260715.0

Enhancements:

• #6970 feat(vulners): add Vulners enrichment connector
• #6967 feat(microsoft-sentinel-intel): publish author as STIX Identity
• #6866 feat(Urlscan.io): migrate connector to the catalog
• #6841 feat(Infoblox): migrate connector to the catalog
• #6707 feat(connectors): add Whisper internal-enrichment connector for infrastructure graph
• #2945 feat(google-secops-soar): develop the integration

Bug Fixes:

• #7002 fix(microsoft-defender-intel): connector crashes on every event with TypeError, HttpUrl + str, during OAuth token acquisition (regression in 7.260520.0)
• #6915 fix(cve): proxy support
• #6670 fix(thehive): case TLP filter bypassed and latent crashes in bundle generation

Pull Requests:

• fix(thehive): enforce TLP filter on cases and fix marking/relation crashes (#6670) by FilipeS0usa (@FilipeS0usa) in #6671
• fix(cve): use proxy from environment (#6915) by Al33t in #6944
• fix(microsoft-defender-intel): handle trailing '/' in URL segments (#7002) by Pauline Eustachy (@Powlinett) in #7004
• feat(whisper): add Whisper internal-enrichment connector (#6707) by Elakkuvan Rajamani (@elakkuvan-r) in #6708
• feat(vulners): add Vulners enrichment connector (#6970) by yokotoka-vulners-com in #6971
• feat(infoblox): migrate connector to manager-supported mode (#6841) by Hugo Dupras (@jabesq) in #6924
• chore(deps): update astral-sh/setup-uv action to v8.3.2 by renovate[bot] in #6909
• feat(microsoft-sentinel-intel): publish STIX identities (#6967) by Pauline Eustachy (@Powlinett) in #6975
• chore(deps): update dependency python-dotenv to v1.2.2 [security] by renovate[bot] in #7007
• chore(deps): update dependency weasyprint to v68 [security] by renovate[bot] in #7010
• chore(deps): update dependency nltk to v3.9.4 [security] by renovate[bot] in #7009
• chore(deps): bump pytest from 8.4.2 to 9.0.3 in /external-import/elastic-security-incidents/tests by Dependabot (@dependabot)[bot] in #7016
• chore(deps): bump pytest from 8.4.2 to 9.0.3 in /internal-enrichment/reversinglabs-spectra-intel-submission/tests by Dependabot (@dependabot)[bot] in #7017
• chore(deps): bump pytest from 8.4.2 to 9.0.3 in /internal-enrichment/reversinglabs-malware-presence/tests by Dependabot (@dependabot)[bot] in #7018
• chore(deps): update dependency censys-platform to ~=0.15.1 by renovate[bot] in #6910
• feat(urlscan): migrate connector to manager-supported mode (#6866) by Hugo Dupras (@jabesq) in #6993

New Contributors:

• Al33t made their first contribution in #6944
• Elakkuvan Rajamani (@elakkuvan-r) made their first contribution in #6708
• yokotoka-vulners-com made their first contribution in #6971

Full Changelog: 7.260710.0...7.260715.0

Version 7.260710.0

Enhancements:

• #6973 feat(sdk): add x_opencti_cwe field to SDK Vulnerability model
• #6956 feat(sekoia): Opt remove confidence from bundle
• #6893 feat(ioc-extractor): new internal enrichment connector to extract IOCs from entity descriptions
• #6843 feat(Hatching Triage Sandbox): migrate connector to the catalog
• #6842 feat(IBM X-Force): migrate connector to the catalog
• #6840 feat(IPsum): migrate connector to the catalog
• #6838 feat(Elastic Security Incidents): migrate connector to the catalog
• #6837 feat(ReversingLabs Malware Presence): migrate connector to the catalog
• #6836 feat(ReversingLabs Spectra Intel Submission): migrate connector to the catalog
• #6766 feat(Tenable Vulnerability Management): migrate connector to the catalog
• #6524 feat(connectors-sdk): create BaseClientAPI
• #6432 feat(datadog-intel): create stream connector forwarding indicators to Datadog Threat Intel
• #6083 feat(vulnerability-lookup): create the connector
• #5793 feat(google-ti): support fetching and modeling indicators associated with campaigns
• #5412 feat(crowdstrike-recon): create EXTERNAL_IMPORT connector to bring CrowdStrike Recon notifications as Incidents into OpenCTI
• #5215 refactor(tenable-vuln-management): migrate connector to be connector manager supported

Bug Fixes:

• #6961 fix(swimlane): invalid scope configuration
• #6960 fix(ctm360-threatcover): Invalid 'scope' configuration
• #6959 fix(argsight-incidents): invalid scope configuration
• #6941 feat(xtm-hub): fix connector manifest description syntax and normalize use_cases
• #6938 fix(import-document): single document takes hours to process, stalling ingestion
• #6934 fix(ci): unused-deps workflow scans connectors outside PR scope
• #6932 fix: add correct logo to Flare connector
• #6922 fix(MISP): MISP attribute level filtering errors
• #6611 fix(feedly): memory leak causing OOM events
• #6372 fix(tenable-security-center): validation error when asset_exposure_score is an empty string

Pull Requests:

• fix(flare): add correct logo for Flare connector (#6932) by Xavier Lavallee (@xvaier) in #6933
• fix(ci): scope unused-deps check to PR-only files (#6934) by Thibaut Rouxel (@throuxel) in #6935
• feat(google-ti-feeds): enable IOC fetching for campaigns (#5793) by Romain GUIGNARD (@romain-filigran) in #6785
• feat(hatching-triage-sandbox): add to catalog (#6843) by Thibaut Rouxel (@throuxel) in #6937
• feat(ibm-xti): migrate connector to manager-supported mode (#6842) by Hugo Dupras (@jabesq) in #6923
• feat(crowdstrike-recon): add new external-import connector (#5412) by Romain GUIGNARD (@romain-filigran) in #6409
• feat(tenable-vuln-management): migrate connector to the catalog (#5215) by Thibaut Rouxel (@throuxel) in #6831
• feat(reversinglabs-malware-presence): add to catalog (#6837) by Thibaut Rouxel (@throuxel) in #6889
• feat(ipsum): migrate connector to manager-supported mode (#6840) by Hugo Dupras (@jabesq) in #6925
• chore(stream-splunk): update connector logo (#6951) by Hugo Dupras (@jabesq) in #6952
• feat(reversinglabs-spectra-intel-submission): add to catalog (#6836) by Thibaut Rouxel (@throuxel) in #6887
• feat(elastic-security-incidents): add to catalog (#6838) by Thibaut Rouxel (@throuxel) in #6931
• fix(tenable-security-center): handle empty string for asset_exposure_score (#6372) by Nicolas Carenton (@ncarenton) in #6950
• feat(xtm-hub): fix connector manifest description syntax and normalize use_cases (#6941) by Romain GUIGNARD (@romain-filigran) in #6942
• fix(feedly): guard markdown conversion against backtracking (#6611) by Hugo Dupras (@jabesq) in #6954
• feat(sdk): implement BaseClientApi (#6524) by Thibaut Rouxel (@throuxel) in #6525
• fix(misp): always send metadata (#6922) by Thibaut Rouxel (@throuxel) in #6953
• feat(mise): add mise task runner with dev workflow tasks (#6807) by Hugo Dupras (@jabesq) in #6809
• ci(connector-linter): enforce blocking VC305 for new connectors and split vclint verified/manager-supported checks (#6882) by Hugo Dupras (@jabesq) in #6914
• feat(ioc-extractor): add new internal enrichment connector for IOC extraction (#6893) by Romain GUIGNARD (@romain-filigran) in #6894
• feat(sdk): add cwe_ids to Vulnerability model (#6973) by Thibaut Rouxel (@throuxel) in #6974
• feat(ci): promote release-connector workflow to production with tag triggers (#6874) by Hugo Dupras (@jabesq) in #6886
• chore(import-document): add per-phase timing logs (#6938) by Kevin Nunes (@nvkhope) in #6939
• feat(datadog-intel): Update connector to be "manager_supported" (#6432) by Pauline Eustachy (@Powlinett) in #6966
• feat(sekoia): Opt remove confidence from bundle (#6656) by Renizmy in #6957
• feat(vulnerability-lookup): create connector (#6083) by Thibaut Rouxel (@throuxel) in #6520
• fix(ctm360-threatcover): make connector scope optional with default value (#6960) by Hugo Dupras (@jabesq) in #6979
• fix(swimlane): make connector scope optional with default value (#6961) by Hugo Dupras (@jabesq) in #6980
• fix(ibm-xti): make connector scope optional with default value (#6977) by Hugo Dupras (@jabesq) in #6981
• fix(arcsight-incidents): make connector scope optional with default value (#6959) by Hugo Dupras (@jabesq) in #6982
• feat(connector-linter): add VC326 check for ListFromString settings missing a default value (#6978) by Hugo Dupras (@jabesq) in #6986

New Contributors:

• Xavier Lavallee (@xvaier) made their first contribution in #6933
• Kevin Nunes (@nvkhope) made their first contribution in #6939

Full Changelog: 7.260706.0...7.260710.0

Version 7.260309.0-lts.6

Pull Requests:

• [accenture-acti] Fix html-to-markdown version pin to resolve Alpine D… by Nicolas Carenton (@ncarenton) in #6613
• fix(feedly): yield bundle to resolve memory issue (#6611) by Hugo Dupras (@jabesq) in #6637

Full Changelog: 7.260309.0-lts.5...7.260309.0-lts.6